[verify] URL previews are never fetched for links in your own composer while typing #142

Closed
opened 2026-09-17 16:26:18 -04:00 by jared · 1 comment
Owner

Confirm the client only asks the homeserver's /preview_url for links in received/sent timeline events, never for text sitting in the composer (some clients pre-fetch on typing, which leaks every URL you paste-then-delete). Check RoomInput, the scheduled-message modal and the edit composer. If any path pre-fetches, remove it.

Confirm the client only asks the homeserver's `/preview_url` for links in **received/sent** timeline events, never for text sitting in the composer (some clients pre-fetch on typing, which leaks every URL you paste-then-delete). Check `RoomInput`, the scheduled-message modal and the edit composer. If any path pre-fetches, remove it.
jared added this to the Features 2026-Q4 milestone 2026-09-17 16:26:18 -04:00
jared added the enhancementpriority: mediumsecurityarea: messaging labels 2026-09-17 16:26:18 -04:00
jared self-assigned this 2026-09-17 16:26:18 -04:00
Author
Owner

Verified on the local dev homeserver with Playwright, capturing every preview_url request:

  • typed check this https://example.org/typing-only?x=1 and https://wikipedia.org/wiki/Typing into the composer with URL previews enabled, waited 4 s → 0 preview requests;
  • pressed Enter → 2 preview requests, one per link, only for the sent message.

Previews are only fetched by UrlPreviewCard when rendering a timeline event (mx.getUrlPreview(url, ts)), never from the composer. Closing.

Verified on the local dev homeserver with Playwright, capturing every `preview_url` request: - typed `check this https://example.org/typing-only?x=1 and https://wikipedia.org/wiki/Typing ` into the composer with URL previews enabled, waited 4 s → **0** preview requests; - pressed Enter → 2 preview requests, one per link, only for the sent message. Previews are only fetched by `UrlPreviewCard` when rendering a timeline event (`mx.getUrlPreview(url, ts)`), never from the composer. Closing.
jared closed this issue 2026-09-18 00:38:30 -04:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#142